Read the docs
TI-2025-42135 Aliases CVE-2025-68617

Use after free in fluidsynth

Priority HIGH 66CWE-416Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-416 and the CVSS impact.

Summary

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From versions 2.5.0 to before 2.5.2, a race condition during unloading of a DLS file can trigger a heap-based use-after-free. A concurrently running thread may be pending to unload a DLS file, leading to use of freed memory, if the synthesizer is being concurrently destroyed, or samples of the (unloaded) DLS file are concurrently used to synthesize audio. This issue has been patched in version 2.5.2. The problem will not occur, when explicitly unloading a DLS file (before synth destruction), provided that at the time of unloading, no samples of the respective file are used by active voices. The problem will not occur in versions of FluidSynth that have been compiled without native DLS support.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00213 11th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed fluidsynth (FluidSynth): 2.5.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FluidSynthfluidsynth2.5.0 to before 2.5.22.5.2Patch availableCNA
  • fluidsynth VendorFluidSynth Affected 2.5.0 to before 2.5.2 Fixed in 2.5.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:fluidsynth:fluidsynth:*:*:*:*:*:*:*:*2.5.0 to before 2.5.2VulnerableFluidSynth
  • cpe:2.3:a:fluidsynth:fluidsynth:*:*:*:*:*:*:*:* Versions 2.5.0 to before 2.5.2 Vulnerable ·FluidSynth

Remediation

  • Fix · CNA fluidsynth (FluidSynth) Fixed in 2.5.2

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-68617

References

Exploit 1

Patch 2

Advisory 1

Other 1

  • TI-2025-35279 fluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in… CVSS 3.1HIGH 7.5
  • TI-2021-04515 Use after free in fluidsynth CVSS 3.1HIGH 7.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences